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In the paper [Phys. Rev. A 65, 052331(2002)], an entanglement-based quantum key distribution 
protocol for d-level systems was proposed. However, in this Comment, it is shown that this protocol 
is insecure for a special attack strategy. 



PACS numbers: 03.67.-a, 03.65.-w, 03.65. Ud 

In the paper V. Kariminpour et al. presented a 
quantum key distribution (QKD) protocol for d-level sys- 
tems based on shared entanglement of a reusable Bell 
state. The security against some individual attacks is 
proved, where the information gain of Eve is zero and 
the QBER introduced by her intervention is (d — l)/d. 
However, in this paper we will show that, by a special 
attack strategy Eve can get about half of the key dits 
without being detected by Alice and Bob. 

For convenience, we use the same notations as in 
Rcf. 1]. Let us give a brief description of the QKD proto- 
col firstly (see Fig.0. At the beginning, Alice and Bob 
share a generalized Bell state 
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Denote the i-th key dit to be sent by which is encoded 
as a basis state \q%)k- To send the key dit qt to Bob, 
Alice performs a controlled- right shift on \qi)k and thus 
entangles this qudit to the previously shared Bell state. 
Then she transmits this qudit to Bob, from which Bob 
can obtain the key dit qi by performing a controlled-left 
shift and a measurement on it. Because every sending 
qudit is in a completely mixed state, Eve can not extract 
information about the key. Furthermore, to strengthen 
the security of this protocol, Alice and Bob perform H ® 
H* on their Bell states before encrypt each 

We will describe Eve's strategy separately for each qu- 
dit. Hereafter we use the term "the i-th round" to denote 
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FIG. 1: The QKD protocol. Note that in this Comment, 
for simplicity, the operation H <g) H* or H ® H* ® H is not 
included in our figures. 
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FIG. 2: Eve's attack in the first round. 



the processing procedures of the i-th qudit, and Alice 
and Bob's operation H ® H* is taken as the beginning of 
each round. In addition, we use \^m)a,b,e and \ipn) a ,b,e 
to denote the states shared by Alice, Bob and Eve in the 
beginning and the end of the z-th round, respectively. 
Suppose Eve prepares |0) as her ancilla, the eavesdrop- 
ping strategy can be described as follows: 

(i) In the first round, Eve entangles her ancilla into the 
Bell state shared by Alice and Bob. More specifically, Eve 
intercepts the sending qudit and performs a controlled- 
right shift on her ancilla, then resends the sending qudit 
to Bob (see Fig. The initial state of Alice, Bob and 
Eve's particles can be represented as 



^ d-l 

\lpw)a,b,e = — \j, j,0) a 
3=0 



b.e- 
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Then the states at various stages in Fig.Elare as follows: 
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-y= ^2 I- 7 ' 3> 3+^,3 + qi)a,b,k,e, (5) 

3=0 
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FIG. 3: Eve's attack in the second round. 
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FIG. 4: Eve's attack in the third round. 
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1*3) = -j=^\j,j,qi,j + qi)a,b,k,e- (6) 

3=0 

In the last stage, when Bob performs his controlled-left 
shift, he disentangles the key qudit \qi)k an d correctly 
gets the value of qi , while the original Bell state has now 
been entangled with the state of Eve in the form of 



|V'u)o, l 



j d-1 
— \3,3yj +Ql)a, 

v% =0 



(7) 



(ii) In the second round, Eve tries to avoid the detec- 
tion and, at the same time, retain her entanglement with 
Alice and Bob. As was proved in Ref.pJ, Eve can not 
obtain information in this round. However, we will show 
that she can take some measures to avoid the detection. 

Firstly, when Alice and Bob perform the operations 
H ® H* on their "Bell state" , Eve also performs H on 
her ancilla. As a result, the entangled state of Alice, Bob 
and Eve will be converted into 



= H ® H* <g> H\lp U )a,b,e 
- d-1 

= ®h* ®H\j,jj+ qi ) aAe 

1 d-1 

J2 C jk - jl+mU+qi) \k,l,m) a ,bA8) 
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Summing over j and using the identity ^ Sj=o C J ™ 
5(n, 0), we finally arrive at 
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k,l=0 



Afterwards, Eve intercepts the sending qudit, performs 
a controlled- right shift on it, and then resends it to Bob 
(see Fig. El- The states at various stages in Fig. are as 
follows: 

d-1 

= ^( 9lM) |fc,i,92,i-fe, (10) 

k.l-0 



|*l) - 2 E C qi{l - k) \kJ,k + q 2 ,l-k) aAk ^ (11) 

k,l=0 
d-1 

1*2) = ^ Y, C qi{l ~ k) \k,l,l + q2,l-k) aAk , e , (12) 
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l* 3 > = 1 E ( qi{l ~ k) \kJ,q2,i-k) aAk , e . (13) 
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In the last stage, when Bob performs his controlled-left 
shift, he disentangles the key qudit \q2)k and correctly 
gets the value of q 2 , while leaving the state 
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(iii) In the third round, Eve eavesdrops the key qu- 
dit. Firstly, as in step.(ii), Eve also performs H on her 
ancilla when Alice and Bob perform H and H* on their 
respective particles. The entangled state will be changed 
into 

|^3o)a,6,e = H <g> H* <g> H\lp 2 l) a,6,e 
^ d-1 

= E l TO ' TO ' TO _ qi)a,b,e- (I 5 ) 



Afterwards, Eve intercepts the sending qudit, performs 
a controlled-left shift, a measurement and a controlled- 
right shift on it, and then resends it to Bob (see Fig. 0}. 
The states at various stages in Fig. 0] are as follows: 

^ d-1 

l^o) = — = J! I TO > TO >93,™- qi)a,b,k,e, (16) 
V rn—0 

1 d_1 

l^l) = —7= X! |"^)"l>»Tl+?3,"l- qi)a : b,k,e, (17) 
v m=0 
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-7= |m,m, g 3 + q 1 ,m- qi) a ,b,k,e, (18) 

* m— 
^ d-1 

l^3> = ^= X! \ m , m , m + Q3, m ~ qi)a,b,k,e, (19) 
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|fkt) = -7= ^ \m, to, g 3 , m - g\) a ,b,k,e- (20) 

It can be seen that Eve disentangles the key qudit by a 
controlled- left shift, performs a measurement, and then 
restores the entangled state by a controlled-right shift. 
As a result, Eve obtains the measurement result 53 + 
qi and Bob correctly gets the value of 93. At last, the 
entangled state of Alice, Bob and Eve can be written as 

1 d_1 

|V>3l)a,&,e = —7= ^ I TO, TO, TO 9l)a,b,e- (21) 
v m— 

(iv) In the fourth round, Eve uses the same strategy as 
in the second round to avoid the detection, that is, the 
strategy in step.(ii). After their operation H ® H* ® H, 
Alice, Bob and Eve change the entangled state into 

|VWa,fc,e = H ® H* ® fr|^3l)o,6, e 

d-l 

= E C'^lM.l-AW (22) 
k,i=a 

Then Eve performs the operations as described in 
Fig. |3 The states at various stages are as follows: 
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k,l=Q 
d-l 

l©i) = -J2C qi(l - k) \kJ,k + q 4 J-k) aAk , e ,(24) 
k,l=0 

1 d-l 

I 02 ) = J E C _flri(i_fc) I*, Z, « + 94, « - fc>a,6,fc, e , (25) 

fc,;=o 

d-l 

ie 3 ) = ^ E r 9i( ^ fc) |fc,^94,«-fe) , blfc , e , (26) 

fc,2=0 

where P corresponds to the state \l/ p in Fig. GO (p = 
0,1,2,3). 

It can be seen that, in the last stage, Bob correctly 
gets the value of 94, while leaving the state 

1 d-l 

|lM«,6,e=j E C^^M-fcW (27) 
fc,2=0 

(v) In the fifth round, Eve uses the same strategy as in 
the third round to eavesdrop the key qudit, that is, the 
strategy in step.(iii). After their operation H eg) H* ® H, 
Alice, Bob and Eve change the entangled state into 



|^50)a,6,e = H H* <g> H \lp4l) a , b ,, 
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-7=y2\j,3,3 +Ql)a>i 
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Then Eve performs the operations as described in 
Fig. 0] The states at various stages are as follows: 
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l T o) = -7=E \j'3'^,j +qi)a,b,k,e, (29) 
3=0 
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= ~7=E I- 7 '- 7 '' J +«5, J + 9l)o,6,fe,e, (30) 
3=0 
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l T 2) = -r=y2\j,j,q5-qi,j + qi)a,b,k,e, (31) 

^ d-l 

= -q^2\^jJ + q r o^ + qi)o..b,k,e, (32) 
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T4) = -T^Ei- 7 '- 7 ' 95 '- 7 ' + 9l)a,b,k,e, 



(33) 



3=0 



where T p corresponds to the state fi p in Fig. IH (p = 
0, 1, 2, 3, 4). It can be seen that Eve's measurement result 
in this round is 95 — 91 . 

Obviously, in the last stage, Bob correctly gets the 
value of 95, while leaving the state 
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Note that |"05i)a,fc,e = |V'ii)o,6,e- Therefore, in the fol- 
lowing rounds, Eve can use the same strategy as in the 
steps from (ii) to (v) repeatedly until the last key dit 
were transmitted. 

Now let us give a concretely description of our eaves- 
dropping strategy: 

1. In the first round, Eve performs the operations as 
described in Fig. [3 

2. When Alice and Bob perform H and H* on their 
respective particles at the beginning of every round 
(except for the first round), Eve also performs H 
on her ancilla; 

3. In every even round, Eve performs the operations 
as described in Fig. |3| 

4. In every odd round (except for the first round), Eve 
performs the operations as described in Fig. 0] 

From the above analysis, we can see that in our eaves- 
dropping strategy no error will be introduced to the key 
distribution between Alice and Bob, and Eve will obtain 
exactly the result of 

93 + 9i , 95 - 9i> 97 + 9i, 99 - 91 , • • ■ 

from which she can infer about half of the key dits by 
checking d possible values for q\. It should be empha- 
sized that there is another profitable fact for Eve. That 
is, at the end of QKD procedure, Alice and Bob will 
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compare a subsequence of the key dits publicly to detect 
eavesdropping, which will leak useful information to Eve. 
More specifically, as long as any odd numbered key dit 
is announced, Eve can determine which of the d possible 
results is true. 

In conclusion, though Eve cannot get information 
about the key dit in every even rounds (as proved in 
Ref.pJ), she can take some more clever measures to avoid 
the detection and retain her entanglement with Alice and 
Bob, so that she can eavesdrop the key dit in the next 
round. Our attack strategy is exactly based on this fact. 



By our strategy Eve can obtain about half of the key dits 
without being detected by Alice and Bob. Consequently 
the QKD protocol in Ref . Q is insecure against this type 
of attack. 
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